[index] AT-AR2050V/AT-AR3050S/AT-AR4050S コマンドリファレンス 5.4.9
Noteアプリケーションコントロール（DPI）機能はAT-AR2050Vでは使用できません。
Note本設定例のルーターB（拠点側ルーター）では、サンドバイン社が提供するアプリケーションシグネチャデータベースを使用するためアニュアルライセンスが必要です。
| 接続用ユーザー名 | user01@ispA | user02@ispA |
| 接続用パスワード | isppasswdA-01 | isppasswdA-02 |
| PPPoEサービス名 | ISP-A | ISP-A |
| WAN側IPアドレス | 10.0.0.1 | 10.0.0.2 |
| 接続用ユーザー名 | user01@ispB | |
| 接続用パスワード | isppasswdB-01 | |
| PPPoEサービス名 | ISP-B | |
| WAN側IPアドレス | 10.1.0.1 | |
| WAN側物理インターフェース | eth1 | eth1 |
| WAN側IPアドレス(1) | 10.0.0.1/32 (ppp0) | 10.0.0.2/32 (ppp0) |
| WAN側IPアドレス(2) | 10.1.0.1/32 (ppp1) | |
| LAN側IPアドレス | 192.168.10.1/24 (vlan1) | 192.168.20.1/24 (vlan1) |
| IPsecトンネルIPアドレス | 172.16.0.1/30 （tunnel1） | 172.16.0.2/30 （tunnel1） |
no spanning-tree rstp enable
interface eth1 encapsulation ppp 0
interface ppp0 ppp service-name ISP-A ppp ipcp dns request keepalive ppp username user01@ispA ppp password isppasswdA-01 ip address 10.0.0.1/32 ip tcp adjust-mss pmtu
interface vlan1 ip address 192.168.10.1/24
zone private network lan ip subnet 172.16.0.0/30 ip subnet 192.168.10.0/24 ip subnet 192.168.20.0/24
zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.1
application esp protocol 50
application isakmp protocol udp dport 500
firewall rule 10 permit any from private to private no-state-enforcement rule 20 permit any from private to public rule 30 permit isakmp from public.wan.ppp0 to public rule 40 permit isakmp from public to public.wan.ppp0 rule 50 permit esp from public.wan.ppp0 to public rule 60 permit esp from public to public.wan.ppp0 rule 70 permit dns from public.wan.ppp0 to public protect
nat rule 10 masq any from private to public enable
crypto isakmp key secret address 10.0.0.2
interface tunnel1 mtu 1300 tunnel source ppp0 tunnel destination 10.0.0.2 tunnel protection ipsec tunnel mode ipsec ipv4 ip address 172.16.0.1/30 ip tcp adjust-mss 1260
ip route 0.0.0.0/0 ppp0 ip route 192.168.20.0/24 Null 254 ip route 192.168.20.0/24 tunnel1
ip dns forwarding
end
no spanning-tree rstp enable
interface eth1 encapsulation ppp 0 encapsulation ppp 1
interface ppp0 ppp service-name ISP-A keepalive ppp username user02@ispA ppp password isppasswdA-02 ip address 10.0.0.2/32 ip tcp adjust-mss pmtu
interface ppp1 ppp service-name ISP-B keepalive ppp username user01@ispB ppp password isppasswdB-01 ip address 10.1.0.1/32 ip tcp adjust-mss pmtu
interface vlan1 ip address 192.168.20.1/24
zone private network lan ip subnet 172.16.0.0/30 ip subnet 192.168.10.0/24 ip subnet 192.168.20.0/24 network tun1 ip subnet 0.0.0.0/0 interface tunnel1
zone public network eth1-1 ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.2 network eth1-2 ip subnet 0.0.0.0/0 interface ppp1 host ppp1 ip address 10.1.0.1
application esp protocol 50
application isakmp protocol udp dport 500
firewall rule 10 permit any from private to private no-state-enforcement rule 20 permit any from private to public rule 30 permit isakmp from public.eth1-1.ppp0 to public rule 40 permit isakmp from public to public.eth1-1.ppp0 rule 50 permit esp from public.eth1-1.ppp0 to public rule 60 permit esp from public to public.eth1-1.ppp0 rule 70 permit undecided from public.eth1-2.ppp1 to public.eth1-2 protect
nat rule 10 masq any from private to public.eth1-2 with src public.eth1-2.ppp1 enable
crypto isakmp key secret address 10.0.0.1
dpi provider procera learning enable
policy-based-routing application-decision once-only ip policy-route 10 match micrsoft from private nexthop ppp1 ip policy-route 20 match office from private nexthop ppp1 policy-based-routing enable
tunnel security-reprocessing
interface tunnel1 mtu 1300 tunnel source ppp0 tunnel destination 10.0.0.1 tunnel protection ipsec tunnel mode ipsec ipv4 ip address 172.16.0.2/30 ip tcp adjust-mss 1260
ip route 0.0.0.0/0 tunnel1 ip route 10.0.0.1/32 ppp0 ip route 192.168.10.0/24 tunnel1 ip route 192.168.10.0/24 Null 254
ip name-server 192.168.10.1
ip dns forwarding
end
copy running-config startup-config」の書式で実行します。awplus# copy running-config startup-config ↓ Building configuration... [OK]
awplus# write memory ↓ Building configuration... [OK]
awplus(config)# log buffered level informational facility kern msgtext Firewall ↓
awplus# show log | include Firewall ↓
! no spanning-tree rstp enable ! interface eth1 encapsulation ppp 0 ! interface ppp0 ppp service-name ISP-A ppp ipcp dns request keepalive ppp username user01@ispA ppp password isppasswdA-01 ip address 10.0.0.1/32 ip tcp adjust-mss pmtu ! interface vlan1 ip address 192.168.10.1/24 ! zone private network lan ip subnet 172.16.0.0/30 ip subnet 192.168.10.0/24 ip subnet 192.168.20.0/24 ! zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.1 ! application esp protocol 50 ! application isakmp protocol udp dport 500 ! firewall rule 10 permit any from private to private no-state-enforcement rule 20 permit any from private to public rule 30 permit isakmp from public.wan.ppp0 to public rule 40 permit isakmp from public to public.wan.ppp0 rule 50 permit esp from public.wan.ppp0 to public rule 60 permit esp from public to public.wan.ppp0 rule 70 permit dns from public.wan.ppp0 to public protect ! nat rule 10 masq any from private to public enable ! crypto isakmp key secret address 10.0.0.2 ! interface tunnel1 mtu 1300 tunnel source ppp0 tunnel destination 10.0.0.2 tunnel protection ipsec tunnel mode ipsec ipv4 ip address 172.16.0.1/30 ip tcp adjust-mss 1260 ! ip route 0.0.0.0/0 ppp0 ip route 192.168.20.0/24 Null 254 ip route 192.168.20.0/24 tunnel1 ! ip dns forwarding ! end
! no spanning-tree rstp enable ! interface eth1 encapsulation ppp 0 encapsulation ppp 1 ! interface ppp0 ppp service-name ISP-A keepalive ppp username user02@ispA ppp password isppasswdA-02 ip address 10.0.0.2/32 ip tcp adjust-mss pmtu ! interface ppp1 ppp service-name ISP-B keepalive ppp username user01@ispB ppp password isppasswdB-01 ip address 10.1.0.1/32 ip tcp adjust-mss pmtu ! interface vlan1 ip address 192.168.20.1/24 ! zone private network lan ip subnet 172.16.0.0/30 ip subnet 192.168.10.0/24 ip subnet 192.168.20.0/24 network tun1 ip subnet 0.0.0.0/0 interface tunnel1 ! zone public network eth1-1 ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.2 network eth1-2 ip subnet 0.0.0.0/0 interface ppp1 host ppp1 ip address 10.1.0.1 ! application esp protocol 50 ! application isakmp protocol udp dport 500 ! firewall rule 10 permit any from private to private no-state-enforcement rule 20 permit any from private to public rule 30 permit isakmp from public.eth1-1.ppp0 to public rule 40 permit isakmp from public to public.eth1-1.ppp0 rule 50 permit esp from public.eth1-1.ppp0 to public rule 60 permit esp from public to public.eth1-1.ppp0 rule 70 permit undecided from public.eth1-2.ppp1 to public.eth1-2 protect ! nat rule 10 masq any from private to public.eth1-2 with src public.eth1-2.ppp1 enable ! crypto isakmp key secret address 10.0.0.1 ! dpi provider procera learning enable ! policy-based-routing application-decision once-only ip policy-route 10 match micrsoft from private nexthop ppp1 ip policy-route 20 match office from private nexthop ppp1 policy-based-routing enable ! tunnel security-reprocessing ! interface tunnel1 mtu 1300 tunnel source ppp0 tunnel destination 10.0.0.1 tunnel protection ipsec tunnel mode ipsec ipv4 ip address 172.16.0.2/30 ip tcp adjust-mss 1260 ! ip route 0.0.0.0/0 tunnel1 ip route 10.0.0.1/32 ppp0 ip route 192.168.10.0/24 tunnel1 ip route 192.168.10.0/24 Null 254 ! ip name-server 192.168.10.1 ! ip dns forwarding ! end
(C) 2015 - 2019 アライドテレシスホールディングス株式会社
PN: 613-002107 Rev.AA